: How to tell Apache to reply with 403 instead of 401? We have some rules for a subtree of Locations, which involve Require-ing ldap-group and exprs. The user is duly challenged to supply login-credentials,
We have some rules for a subtree of Locations, which involve Require-ing ldap-group and exprs.
The user is duly challenged to supply login-credentials, which are verified.
However, even when the credentials are correct and the access is denied due to other reasons (such as belonging to a wrong group or coming from an incorrect IP-address), the server's response is always 401 -- instead of 403.
As a result, the browsers keep prompting users to "try again"... Can I tell Apache (2.4) to use 403, if the information supplied in the Authorization-header checks-out, and it is some other rule, that rejects the request?
More posts by @LarsenBagley505
1 Comments
Sorted by latest first Latest Oldest Best
(Posting a copy of my answer on Server Fault, per OP's request.)
I think what you want is AuthzSendForbiddenOnFailure:
AuthzSendForbiddenOnFailure On
Context: directory, .htaccess
If authentication succeeds but authorization fails, Apache HTTPD will respond with an HTTP response code of '401 UNAUTHORIZED' by default. This usually causes browsers to display the password dialogue to the user again, which is not wanted in all situations. AuthzSendForbiddenOnFailure allows to change the response code to '403 FORBIDDEN'.
Note that it carries a security warning:
Security Warning
Modifying the response in case of missing authorization weakens the security of the password, because it reveals to a possible attacker, that his guessed password was right.
Terms of Use Create Support ticket Your support tickets Stock Market News! © vmapp.org2024 All Rights reserved.